Critical RCE flaw detected in Cisco’s communication software

Cisco warns that some Unified Communications Manager and Contact Center Solutions products have a critical remote code execution security vulnerability.

Cisco’s Unified Communications and Contact Center Solutions offer voice, video, and messaging services, as well as customer engagement and management.

• Uncategorized

Cisco released security updates for two critical security flaws

By infosecbulletin / Thursday , September 5 2024

CISCO released security updates for two critical security flaws impacting its smart Licensing Utility that could allow unauthenticated, remote attackers...

Read More

• Hot Topic

OpenBAS: Cutting-edge breach and attack simulation platform

By infosecbulletin / Wednesday , September 4 2024

OpenBAS is a platform that helps organizations to plan, schedule, and conduct crisis exercises, adversary simulations, and breach simulations. OpenBAS...

Read More

• Vulnerabilities

Critical Security Flaws Patched in Zyxel Networking Devices

By infosecbulletin / Wednesday , September 4 2024

Zyxel has released software updates to fix a serious security issue in certain access point (AP) and security router versions....

Read More

• Vulnerabilities

CVE-2024-38811: CEV In VMware Fusion Unveiled

By infosecbulletin / Tuesday , September 3 2024

VMware released a security advisory for a major vulnerability in the VMware Fusion product. This vulnerability could be exploited by...

Read More

• Cyber Attack
• Vulnerabilities

CERT-IN Warns Vulnerabilities in Palo Alto Networks applications

By infosecbulletin / Tuesday , September 3 2024

Indian Computer Emergency Response Team (CERT-IN) issued advisories about multiple vulnerabilities in various Palo Alto Networks applications. Attackers could exploit...

Read More

• International

How Malaysia’s Data Centre Industry Poised for Growth

By infosecbulletin / Tuesday , September 3 2024

Malaysia is quickly becoming a leading choice for investing in data centers. It aims to generate RM3.6 billion (US$781 million)...

Read More

• Cyber Attack

RansomHub exfiltrated data over 210 victims: US alert

By infosecbulletin / Tuesday , September 3 2024

US authorities have issued a cybersecurity advisory about a ransomware group called RansomHub. The group is thought to have stolen data...

Read More

• Vulnerabilities

Godzilla Fileless Backdoor Exploits Atlassian Confluence flaw

By infosecbulletin / Tuesday , September 3 2024

There is a new way to attack Atlassian Confluence using the vulnerability CVE-2023-22527. The Confluence Data Center and Server products...

Read More

• Cyber Attack

New Cicada ransomware targets VMware ESXi servers

By infosecbulletin / Tuesday , September 3 2024

The Cicada3301 ransomware is made in Rust and attacks Windows and Linux/ESXi hosts. Truesec researchers examined a version that targets...

Read More

• Uncategorized

Monday hits two UK bank apps causes outages

By infosecbulletin / Tuesday , September 3 2024

Lloyds Bank and Virgin Money's internet banking services were down on Monday, causing trouble for users to access and view...

Read More

The company issued a security bulletin about a vulnerability (CVE-2024-20253) that could let an unauthorized remote attacker run code on a device.

Researcher Julien Egloff from Synacktiv discovered a vulnerability with a 9.9 base score out of 10. The vulnerability is due to incorrect handling of user-input data stored in memory.

Attackers can exploit this vulnerability by sending a carefully designed message to a specific port. This can allow them to execute any command using the web services user’s privileges and gain root access.

CVE-2024-20253 impacts the following Cisco products in their default configurations:

Packaged Contact Center Enterprise (PCCE) versions 12.0 and earlier, 12.5(1) and 12.5(2)
Unified Communications Manager (Unified CM) versions 11.5, 12.5(1), and 14. (same for Unified CM SME)
Unified Communications Manager IM & Presence Service (Unified CM IM&P) versions 11.5(1), 12.5(1), and 14.
Unified Contact Center Enterprise (UCCE) versions 12.0 and earlier, 12.5(1), and 12.5(2).
Unified Contact Center Express (UCCX) versions 12.0 and earlier and 12.5(1).
Unity Connection versions 11.5(1), 12.5(1), and 14.
Virtualized Voice Browser (VVB) versions 12.0 and earlier, 12.5(1), and 12.5(2).

The vendor says there’s no other solution and advises applying the security updates. The updates fix the critical remote code execution (RCE) flaw.

PCCE: 12.5(1) and 12.5(2) apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn.
Unified CM and Unified CME: 12.5(1)SU8 or ciscocm.v1_java_deserial-CSCwd64245.cop.sha512. 14SU3 or ciscocm.v1_java_deserial-CSCwd64245.cop.sha512.
Unified CM IM&P: 12.5(1)SU8 or ciscocm.cup-CSCwd64276_JavaDeserialization.cop.sha512. 14SU3 or ciscocm.cup-CSCwd64276_JavaDeserialization.cop.sha512.
UCCE: Apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn for 12.5(1) and 12.5(2).
UCCX: Apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn for 12.5(1).
VVB: Apply patch ucos.v1_java_deserial-CSCwd64245.cop.sgn for 12.5(1) and 12.5(2).

Cisco recommends using access control lists (ACLs) as a mitigation strategy when applying updates is not immediately feasible.